@bongos/core 1.20.37 → 1.20.39

package/modules/provisioning/render-standup.js

@@ -31,6 +31,18 @@ const MODES = ['adopt', 'greenfield'];
 // How the owner's app is built (task 1004350): a native runtime with their commands, or
 // `docker`, which builds the repository's own Dockerfile.
 const RUNTIMES = ['node', 'python', 'ruby', 'go', 'rust', 'elixir', 'docker'];
+// Render refuses a native web service with no build command (measured live 2026-09-30,
+// task 1004464), so every native runtime has one: Render's own default for it. The runner
+// sends it when the owner gave none, and the wizard prefills it (projects.html keeps a
+// copy, pinned equal by tests/projects_hub_app_step.mjs).
+const BUILD_DEFAULTS = Object.freeze({
+  node: 'npm install',
+  python: 'pip install -r requirements.txt',
+  ruby: 'bundle install',
+  go: 'go build -tags netgo -ldflags \'-s -w\' -o app',
+  rust: 'cargo build --release',
+  elixir: 'mix deps.get --only prod && MIX_ENV=prod mix compile',
+});
 
 // Render API keys start `rnd_`; workspaces are `tea-…` (a team) or `usr-…` (a personal
 // one); services `srv-…`. Shape checks only — whether the key works, and whether it can
@@ -134,4 +146,4 @@ async function attachToProvision(db, instanceId, { keyEnc, appHost }) {
   return rows[0] || null;
 }
 
-module.exports = { attachToProvision, KEY_RE, OWNER_RE, WEB_PLANS, DB_PLANS, REGIONS, MODES, RUNTIMES, badRequest, appHostFrom, enqueueRenderStandup };
+module.exports = { attachToProvision, KEY_RE, OWNER_RE, WEB_PLANS, DB_PLANS, REGIONS, MODES, RUNTIMES, BUILD_DEFAULTS, badRequest, appHostFrom, enqueueRenderStandup };

package/modules/public-landing/public/projects.html

@@ -1433,7 +1433,7 @@ summary{min-height:24px;padding:3px 0;}
                       <option value="docker">Docker — use my repository’s Dockerfile</option>
                     </select>
                   </label>
-                  <label class="wizField" id="renderBuildWrap"><span>Build command <small>— leave empty if there is none</small></span>
+                  <label class="wizField" id="renderBuildWrap"><span>Build command <small>— Render needs one; the usual one is filled in</small></span>
                     <input type="text" id="f-renderBuild" autocomplete="off" spellcheck="false" maxlength="500" placeholder="for example: npm ci">
                   </label>
                   <label class="wizField" id="renderStartWrap"><span>Start command</span>
@@ -1808,6 +1808,18 @@ summary{min-height:24px;padding:3px 0;}
   function planPrice(p) { return p[2] ? 'about $' + p[2] + '/month' : RENDER_FREE_NOTE; }
   var RENDER_DB_PLANS = [['basic_256mb', 'Basic 256 MB', 6], ['basic_1gb', 'Basic 1 GB', 19], ['basic_4gb', 'Basic 4 GB', 75]];
   var RENDER_RUNTIMES = { node: 'Node.js', python: 'Python', ruby: 'Ruby', go: 'Go', rust: 'Rust', elixir: 'Elixir', docker: 'Docker' };
+  /* Render refuses a native app with no build command (task 1004464), so the box starts
+     with Render's own default for the runtime — a real value the owner can change, and
+     one that follows the runtime until they do. A copy of render-standup.js's
+     BUILD_DEFAULTS (this page cannot require it), pinned equal by a test. */
+  var RENDER_BUILD_DEFAULTS = {
+    node: 'npm install',
+    python: 'pip install -r requirements.txt',
+    ruby: 'bundle install',
+    go: 'go build -tags netgo -ldflags \'-s -w\' -o app',
+    rust: 'cargo build --release',
+    elixir: 'mix deps.get --only prod && MIX_ENV=prod mix compile'
+  };
   var RENDER_KEY_RE = /^rnd_[A-Za-z0-9]{16,128}$/;
   function planLabel(list, v) {
     var p = list.filter(function (x) { return x[0] === v; })[0] || list[0];
@@ -1894,6 +1906,8 @@ summary{min-height:24px;padding:3px 0;}
       q('f-renderRuntime').value = st.renderRuntime || 'node';
       var docker = q('f-renderRuntime').value === 'docker';
       q('renderBuildWrap').hidden = docker; q('renderStartWrap').hidden = docker;
+      // the runtime's usual build command until the owner types their own (task 1004464)
+      if (!st.renderBuildTouched) st.renderBuild = RENDER_BUILD_DEFAULTS[q('f-renderRuntime').value] || '';
       q('f-renderBuild').value = st.renderBuild || '';
       q('f-renderStart').value = st.renderStart || '';
       fillPlans(q('f-renderPlan'), RENDER_WEB_PLANS, st.renderPlan || 'starter');
@@ -1975,13 +1989,12 @@ summary{min-height:24px;padding:3px 0;}
       hooks.save(); syncNew();
     });
     q('renderNew').addEventListener('input', function (ev) {
-      if (ev.target.id === q('f-renderBuild').id) st.renderBuild = ev.target.value;
-      if (ev.target.id === q('f-renderStart').id) {
-        st.renderStart = ev.target.value;
-        // the "say how your app starts" ask is answered the moment there is a command —
-        // it used to stay on screen until the next press of Next
-        if (String(st.renderStart).trim() && /\berr\b/.test(q('h-render').className)) hint('h-render', '');
-      }
+      var typed = null;
+      if (ev.target.id === q('f-renderBuild').id) { st.renderBuild = ev.target.value; st.renderBuildTouched = true; typed = st.renderBuild; }
+      if (ev.target.id === q('f-renderStart').id) { st.renderStart = ev.target.value; typed = st.renderStart; }
+      // a "say how your app starts / is built" ask is answered the moment that box has a
+      // command — it used to stay on screen until the next press of Next
+      if (typed != null && String(typed).trim() && /\berr\b/.test(q('h-render').className)) hint('h-render', '');
       hooks.save();
     });
     function validate() {
@@ -1993,6 +2006,7 @@ summary{min-height:24px;padding:3px 0;}
       if (st.renderMode === 'adopt') {
         if (!services.some(function (s) { return s.id === st.renderServiceId && repoOf(s.repo) === repo().toLowerCase(); })) return bad('Choose the app to link, or create a new one.');
       } else if (st.renderMode === 'greenfield') {
+        if ((st.renderRuntime || 'node') !== 'docker' && !String(st.renderBuild || '').trim()) return bad('Say how your app is built — Render needs a build command, for example “npm install”.');
         if ((st.renderRuntime || 'node') !== 'docker' && !String(st.renderStart || '').trim()) return bad('Say how your app starts — the command Render should run, for example “npm start”.');
       } else return bad('Choose whether to create a new app or link one you already run.');
       hint('h-render', '');

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.37",
+  "version": "1.20.39",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.37",
+      "version": "1.20.39",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.37",
+  "version": "1.20.39",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8313,5 +8313,35 @@
       "id": "1004406",
       "text": "The unattended runner stops restarting every time anyone merges: it now updates its code in place and only restarts when its own code has changed."
     }
+  ],
+  "1.20.38": [
+    {
+      "id": "1004468",
+      "text": "The nightly auto-update now follows the update rule you set on /deploy for each project, instead of a file on the server."
+    },
+    {
+      "id": "1004453",
+      "text": "When you start Autobongos from the Gate page you can now pick a priority goal: the runner works that goal first and moves to the other allowed goals only when it runs out of work there."
+    },
+    {
+      "id": "1004472",
+      "text": "Fixes the broken automatic check on main that was stopping everyone's finished work from landing."
+    },
+    {
+      "text": "When a builder complains that Bongos isn't working, their assistant now reports it to the Bongos team by itself, so every frustration becomes something on the fix list."
+    },
+    {
+      "text": "Builders on any Cloud Bongos project can now send feedback about Bongos itself with one command, and it arrives with the Bongos team as a task waiting for approval."
+    }
+  ],
+  "1.20.39": [
+    {
+      "id": "1004465",
+      "text": "A version preview that cannot read its data now fails with the child's own output shown, and stopping it really removes its copy."
+    },
+    {
+      "id": "1004464",
+      "text": "Setting up an app on Render from the project wizard no longer fails when the owner leaves the build command empty. The box now comes filled in with Render's usual build command for the chosen language, which the owner can chan"
+    }
   ]
 }

package/scripts/gds/autobongos-run.js

@@ -106,6 +106,15 @@ function record(entry) {
   return row;
 }
 
+// pickedFrom — the row fields that say where a pick came from (task 1004453).
+// `priority` is true only when the fence named a priority goal AND this pick came
+// from it, so "the priority goal ran dry and the runner moved on" reads as
+// priority:false beside the goal it moved on to.
+function pickedFrom(goalId, gate) {
+  const p = gate && gate.priorityGoal != null ? gate.priorityGoal : null;
+  return { priority: p !== null && Number(goalId) === p };
+}
+
 // pickTask — the allowlisted goals, in order, through sequence.js's halt matrix.
 // The matrix is reused rather than re-derived: it already refuses thin specs,
 // protected paths, judgement kinds and unmet dependencies, from facts on the row.
@@ -479,7 +488,7 @@ async function iteration(opts, deps = {}) {
       // looks like, and it must still reach the failure ladder (task 1004179).
       if (lastRefusal) return lastRefusal;
       return log({
-        event: 'nothing_claimable', goals: gate.goals,
+        event: 'nothing_claimable', goals: gate.goals, priority_goal: gate.priorityGoal ?? null,
         // Carried so the cadence can tell an EMPTY queue from one where every task
         // halts — the reasons are the matrix's own codes, safe to print.
         skipped: (got.skipped || []).map((sk) => ({ id: sk.id, goal_id: sk.goal_id, reasons: (sk.reasons || []).map((r) => r.code) })),
@@ -501,10 +510,10 @@ async function iteration(opts, deps = {}) {
       task: candidate, goals: gate.goals, protectedHits: matchProtected(candidate.touches || []),
     });
     if (!taskGate.go) {
-      return log({ event: 'fenced', code: taskGate.code, reason: taskGate.reason, task_id: candidate.id, goal_id: got.goalId, globs: taskGate.globs || [] });
+      return log({ event: 'fenced', code: taskGate.code, reason: taskGate.reason, task_id: candidate.id, goal_id: got.goalId, ...pickedFrom(got.goalId, gate), globs: taskGate.globs || [] });
     }
 
-    if (opts.dryRun) return log({ event: 'dry_run', task_id: candidate.id, title: candidate.title, goal_id: got.goalId });
+    if (opts.dryRun) return log({ event: 'dry_run', task_id: candidate.id, title: candidate.title, goal_id: got.goalId, ...pickedFrom(got.goalId, gate) });
 
     // 3. The task's own working tree.
     const name = deps.worktreeName ? deps.worktreeName(candidate.id) : worktreeName(candidate.id);
@@ -566,6 +575,7 @@ async function iteration(opts, deps = {}) {
 
   const row = {
     event: 'worked', task_id: task.id, title: task.title, goal_id: picked.goalId,
+    ...pickedFrom(picked.goalId, gate),
     worktree: wtName,
     outcome: verdict.outcome, reason: verdict.reason,
     session_id: res.sessionId || null, duration_s: Math.round((Date.now() - started) / 1000),
@@ -1043,7 +1053,7 @@ async function forever(opts, deps = {}) {
       // task 1234" from "quiet because it is dead". A worker may hold the loop for
       // ninety minutes, and without this every honest hour of work looks like a
       // corpse.
-      await beat({ mode: state.mode, last_event: row.event, working_task_id: Number(row.task_id) || undefined });
+      await beat({ mode: state.mode, last_event: row.event, working_task_id: Number(row.task_id) || undefined, working_goal_id: Number(row.goal_id) || undefined });
       const seen = cadence.classifyEvent(row);
       // A hold that names its reset SECOND waits until that second (task 1004454).
       // classifyEvent carries it as an absolute epoch; the cadence has no clock of

package/scripts/gds/feedback-send.js

@@ -0,0 +1,131 @@
+#!/usr/bin/env node
+// Send feedback about Bongos itself to the Cloud Bongos maintainers (task 1004462).
+//
+// Usage:
+//   bongos feedback "the claim command hung for two minutes"
+//   bongos feedback --idea "let me filter the task list by goal"
+//   bongos feedback --message-file notes.md
+//   [--json]
+//
+// Not the /feedback skill, which loads a locally recorded walkthrough into a
+// session. This SENDS: it posts to the builder's OWN project (POST /feedback,
+// src/bongos/routes/feedback.js), which relays it to the hub. A bug lands on the
+// hub as a 'backlog' task in the maintenance goal awaiting a maintainer's nod; an
+// idea lands in the hub's idea inbox. Only the typed text and version stamps
+// travel — never code, a transcript or file contents.
+
+'use strict';
+
+const os = require('node:os');
+const { cliClient, requireSession, argText, hasFlag, errCode, errDetails, cliExit } = require('./cli-lib');
+
+const USAGE = [
+  'usage:',
+  '  bongos feedback "what went wrong"          report a problem with Bongos',
+  '  bongos feedback --idea "what you wish for" suggest an improvement',
+  '  bongos feedback --message-file notes.md    send a longer note from a file',
+  '',
+  'Goes to the Cloud Bongos maintainers. Only the text you type and the Bongos',
+  'versions you run are sent — no code, chat or files from your project.',
+].join('\n');
+
+// The CLI release, as `bongos version` reports it: config/bongos-cli.json where
+// the core checkout carries it (an instance does not — task 1824), else the
+// package version. Read from disk, never required, so a vanilla core still runs.
+function cliVersion() {
+  const fs = require('node:fs');
+  const path = require('node:path');
+  for (const rel of ['../../config/bongos-cli.json', '../../package.json']) {
+    try {
+      const f = path.join(__dirname, rel);
+      if (fs.existsSync(f)) { const v = JSON.parse(fs.readFileSync(f, 'utf8')).version; if (v) return v; }
+    } catch { /* try the next */ }
+  }
+  return null;
+}
+
+// The message: --message / --message-file, else every positional word joined.
+function readMessage(args) {
+  if (args.includes('--message') || args.includes('--message-file')) return argText('--message', args);
+  return args.filter((a) => !a.startsWith('--')).join(' ');
+}
+
+// Every report goes through the transcript-grade secret scrubber before it leaves
+// this machine (task 1004467). An assistant may file unasked when a builder vents,
+// so nobody reviews the text first — the scrubber is the check that does not
+// depend on the assistant's judgment. FAIL CLOSED: no scrubber, nothing is sent.
+// It also strips the builder's environment secrets by value, whatever their shape.
+function scrubReport(message, env = process.env) {
+  let scrub;
+  try { scrub = require('../../modules/security/secret-scrub.js'); } catch { return null; }
+  const text = scrub.scrubSecrets(message, scrub.collectEnvSecrets(env));
+  const removed = text.split(scrub.REDACTED).length - message.split(scrub.REDACTED).length;
+  return { text, removed };
+}
+
+// Plain-language lines for each refusal the route can give.
+const REFUSALS = {
+  message_required: 'Nothing to send — add your feedback after the command, in quotes.',
+  validation_failed: 'That could not be sent as written — keep it under 4,000 characters, or split it into two.',
+  not_hub_connected: 'This project is not connected to Cloud Bongos, so feedback cannot be relayed from here.\n'
+    + 'Report it to the Bongos maintainers on the Bongos core repository instead.',
+  membership_required: 'Cloud Bongos does not yet know you as a member of this project.\n'
+    + 'Sign in to this project once through Cloud Bongos in a browser, then try again.',
+  rate_limited: 'Too much feedback from you or this project in the last hour. Try again later.',
+  feedback_unavailable: 'Cloud Bongos is not taking bug reports right now (no version is being built). Try again later.',
+  hub_unreachable: 'Could not reach Cloud Bongos. Check your connection and try again.',
+};
+
+async function main(argv = process.argv.slice(2)) {
+  if (hasFlag('--help', argv) || hasFlag('-h', argv)) { console.log(USAGE); return 0; }
+  const json = hasFlag('--json', argv);
+  const kind = hasFlag('--idea', argv) ? 'idea' : 'bug';
+  const message = String(readMessage(argv) || '').trim();
+  if (!message) { console.error(USAGE); return 2; }
+
+  const scrubbed = scrubReport(message);
+  if (!scrubbed) {
+    console.error('Feedback was not sent: the secret filter that checks every report is missing from this install.');
+    return 1;
+  }
+
+  await requireSession();
+  const api = await cliClient();
+  const res = await api.request('POST', '/feedback', {
+    body: { message: scrubbed.text, kind, context: { cli_version: cliVersion(), os: `${os.platform()} ${os.release()}` } },
+  });
+  if (scrubbed.removed > 0 && !json) {
+    console.log(`Removed ${scrubbed.removed} secret-looking value(s) from the report before sending.`);
+  }
+
+  if (json) { console.log(JSON.stringify(res.data, null, 2)); return res.ok ? 0 : 1; }
+  if (!res.ok) {
+    const code = errCode(res.data);
+    const details = errDetails(res.data) || {};
+    let line = REFUSALS[code] || `Feedback was not sent (${code || `HTTP ${res.status}`}).`;
+    if (code === 'rate_limited' && details.retry_after_seconds) {
+      line += ` (in about ${Math.ceil(details.retry_after_seconds / 60)} min)`;
+    }
+    console.error(line);
+    return 1;
+  }
+  const d = res.data || {};
+  if (d.landed === 'task') {
+    console.log(`Thanks — sent to the Cloud Bongos maintainers as task ${d.task_id}.`);
+    console.log('It waits for a maintainer to approve it before anyone works on it.');
+    if (d.hub_origin) console.log(`${String(d.hub_origin).replace(/\/+$/, '')}/builders#/task/${d.task_id}`);
+  } else {
+    console.log(`Thanks — your idea is in the Cloud Bongos idea inbox (idea ${d.idea_id}) for the maintainers to review.`);
+  }
+  return 0;
+}
+
+if (require.main === module) {
+  // cliExit, never process.exit, after a request (task 1002734 — the Windows abort).
+  main().then((code) => cliExit(code), (err) => {
+    console.error(`Feedback was not sent: ${err && err.message ? err.message : err}`);
+    cliExit(1);
+  });
+}
+
+module.exports = { main, readMessage, REFUSALS, scrubReport };

package/scripts/gds/provision-render.js

@@ -117,6 +117,18 @@ async function greenfield(api, inst, host, deps) {
   return { ok: true };
 }
 
+// The owner reads this reason on the setup screen (app-status.js oneSentence). A refusal
+// from Render's API used to arrive as its raw line — "Render POST /services failed: …" —
+// so an answer from Render is re-said as a sentence with Render's own reason kept whole
+// (task 1004464). Anything else is already the leg's own words.
+function plainReason(e) {
+  const msg = e && e.message ? e.message : String(e);
+  const said = e && e.status != null && e.body && typeof e.body.message === 'string' ? e.body.message.trim() : '';
+  if (said) return `Render would not set up the app: ${said}`;
+  const m = /^Render (?:GET|POST|PATCH|PUT|DELETE) \S+ failed: ([\s\S]+)$/.exec(msg);
+  return m ? `Render would not set up the app: ${m[1].trim()}` : msg;
+}
+
 async function renderStandupInstance(inst, deps, intent) {
   const { db, log } = deps;
   const secretBox = deps.secretBox || require('../../src/bongos/secret-box');
@@ -137,7 +149,7 @@ async function renderStandupInstance(inst, deps, intent) {
 
     return host.mode === 'adopt' ? await adopt(api, inst, host, deps) : await greenfield(api, inst, host, deps);
   } catch (e) {
-    return refuse(e && e.message ? e.message : String(e));
+    return refuse(plainReason(e));
   } finally {
     if (intent && intent.id != null) await clearBorrowedKey(db, intent.id);
   }

package/scripts/gds/render-payload.js

@@ -21,7 +21,7 @@
 'use strict';
 
 // The vocabulary lives with the web tier's validation, so the two can never disagree.
-const { WEB_PLANS, DB_PLANS, REGIONS, RUNTIMES } = require('../../modules/provisioning/render-standup.js');
+const { WEB_PLANS, DB_PLANS, REGIONS, RUNTIMES, BUILD_DEFAULTS } = require('../../modules/provisioning/render-standup.js');
 const DEFAULTS = Object.freeze({ webPlan: 'starter', dbPlan: 'basic_256mb', region: 'virginia' });
 
 // A Render resource name from the project's slug. Render allows letters, digits and
@@ -47,14 +47,15 @@ function plansFor(appHost) {
 }
 
 // How the app is built and started, as the owner said. `docker` builds the repository's
-// own Dockerfile and needs no commands; every other runtime needs a start command, and a
-// build command if the app has a build step.
+// own Dockerfile and needs no commands; every other runtime needs a start command AND a
+// build command — Render refuses a native service without one (task 1004464), so a row
+// saved with none (including every row from before that fix) gets the runtime's default.
 function buildFor(appHost) {
   const h = appHost || {};
   if (!RUNTIMES.includes(h.runtime)) throw new Error(`unknown Render runtime '${h.runtime || 'none'}'`);
   if (h.runtime === 'docker') return { runtime: 'docker' };
   if (!h.startCommand) throw new Error('the app needs a start command');
-  return { runtime: h.runtime, buildCommand: h.buildCommand || null, startCommand: h.startCommand };
+  return { runtime: h.runtime, buildCommand: h.buildCommand || BUILD_DEFAULTS[h.runtime], startCommand: h.startCommand };
 }
 
 // POST /postgres. `plan` is never 'free' — see the header.
@@ -68,7 +69,7 @@ function renderPostgresPayload(inst, { ownerId, dbPlan, region }) {
 function renderServicePayload(inst, { ownerId, repoUrl, branch, webPlan, region, build, dbUrl }) {
   const envSpecificDetails = build.runtime === 'docker'
     ? {}
-    : { ...(build.buildCommand ? { buildCommand: build.buildCommand } : {}), startCommand: build.startCommand };
+    : { buildCommand: build.buildCommand, startCommand: build.startCommand };
   return {
     type: 'web_service',
     name: resourceName(inst),

package/scripts/gds/update-channel.js

@@ -228,6 +228,82 @@ function loadSubscriptions({ instanceDir = process.cwd(), fsImpl = fs, file = SU
   };
 }
 
+// ---- the per-project rule set on /deploy (task 1004468, ADR 0357) -----------
+// The owner sets each project's update rule on /deploy, which writes
+// provisioning_instances.update_channel (migration provisioning_029, task 1004445). That column
+// is the rule; the roster's `channel` is only the fallback for an entry no project row matches,
+// or for a sweep that cannot reach the database. Before this, the button followed the column and
+// the sweep followed the roster, so a project set to `minor` on /deploy was still swept as `patch`.
+//
+// Matched by slug — the one stable key the table has (it records no directory). Read over psql,
+// which is how upgrade.js recordLedger reaches a PGDATABASE (a bare name over the unix socket +
+// peer auth, the self-host shape). recordLedger uses the pg driver for DATABASE_URL; this passes
+// the URL to `psql -d` instead, because the sweep is synchronous and pg is not. With no psql the
+// sweep falls back to the roster and says so.
+//
+// A failure's reason is a fixed class, never psql's own text: stderr can name a DB user or host,
+// and the reason is printed into the sweep's log.
+const CHANNEL_SOURCE_DEPLOY = 'deploy';
+const CHANNEL_SOURCE_ROSTER = 'roster';
+const DB_CHANNELS_SQL = 'SELECT slug, update_channel FROM provisioning_instances';
+const DB_CHANNELS_TIMEOUT_MS = 15000;
+
+// PURE. psql's stderr reduced to a class that is safe to log.
+function psqlFailureClass(stderr) {
+  const s = String(stderr || '');
+  if (/relation .*provisioning_instances.* does not exist/i.test(s)) return 'no provisioning_instances table (provisioning module off?)';
+  if (/column .*update_channel.* does not exist/i.test(s)) return 'no update_channel column (migration provisioning_029 not applied)';
+  if (/authentication failed|role .* does not exist|permission denied/i.test(s)) return 'the sweep\'s database login was refused';
+  if (/could not connect|connection refused|no such file or directory|could not translate host/i.test(s)) return 'database unreachable';
+  if (/database .* does not exist/i.test(s)) return 'the named database does not exist';
+  return 'query failed';
+}
+
+// The line a sweep prints for one entry's channel. PURE.
+function channelLine(inst) {
+  return `  • ${inst.slug}: channel ${inst.channel}, ${inst.channelNote}`;
+}
+
+// Read every project's update rule. Never throws: { ok:true, channels: Map<slug, channel> }, or
+// { ok:false, reason } when there is no database to ask, psql is missing, or the table is absent
+// (an instance with the provisioning module off). The caller falls back to the roster and says why.
+function readDbChannels({ env = process.env, run = spawnSync } = {}) {
+  const target = env.DATABASE_URL || env.PGDATABASE;
+  if (!target) return { ok: false, reason: 'no DATABASE_URL or PGDATABASE set for the sweep' };
+  const r = run('psql', ['-d', target, '-At', '-F', '\t', '-v', 'ON_ERROR_STOP=1', '--no-psqlrc', '-c', DB_CHANNELS_SQL],
+    { encoding: 'utf8', timeout: DB_CHANNELS_TIMEOUT_MS });
+  if (!r || r.error) {
+    const code = r && r.error && r.error.code;
+    return { ok: false, reason: code === 'ENOENT' ? 'psql not found' : code === 'ETIMEDOUT' ? 'psql timed out' : 'psql could not be started' };
+  }
+  if (r.status !== 0) return { ok: false, reason: `psql exit ${r.status}: ${psqlFailureClass(r.stderr)}` };
+  const channels = new Map();
+  for (const line of String(r.stdout || '').split('\n')) {
+    const [slug, ch] = line.split('\t');
+    if (slug && ch) channels.set(slug.trim(), ch.trim());
+  }
+  return { ok: true, channels };
+}
+
+// PURE. Give each roster entry the channel it is actually under, and say where it came from:
+// `channelSource` is 'deploy' (the project row) or 'roster', `channelNote` the one-line reason a
+// sweep log prints. The roster's own value is kept as `rosterChannel`, so a disagreement stays
+// visible in the log instead of silently vanishing.
+function applyDbChannels(instances, db) {
+  return instances.map((inst) => {
+    if (db && db.ok && db.channels.has(inst.slug)) {
+      const ch = normalizeChannel(db.channels.get(inst.slug));
+      const differs = ch !== inst.channel;
+      return {
+        ...inst, channel: ch, channelSource: CHANNEL_SOURCE_DEPLOY, rosterChannel: inst.channel,
+        channelNote: `set on /deploy${differs ? ` (roster says ${inst.channel}, ignored)` : ''}`,
+      };
+    }
+    const why = db && db.ok ? 'no project row for this slug' : (db && db.reason) || 'database not read';
+    return { ...inst, channelSource: CHANNEL_SOURCE_ROSTER, rosterChannel: inst.channel, channelNote: `from the roster — ${why}` };
+  });
+}
+
 // ---- reporting: make "nothing happened" audible -----------------------------
 
 // Turn a loadSubscriptions() result into the line a routine prints EVERY run, plus a level a caller
@@ -322,6 +398,12 @@ module.exports = {
   listAvailableVersions,
   parseNpmViewVersions,
   loadSubscriptions,
+  readDbChannels,
+  applyDbChannels,
+  channelLine,
+  psqlFailureClass,
+  CHANNEL_SOURCE_DEPLOY,
+  CHANNEL_SOURCE_ROSTER,
   ROSTER_OK,
   ROSTER_ABSENT,
   ROSTER_MALFORMED,

package/src/bongos/routes/feedback.js

@@ -0,0 +1,110 @@
+'use strict';
+
+// src/bongos/routes/feedback.js — POST /api/bongos/feedback (task 1004462).
+//
+// `bongos feedback "…"` lands here, on the builder's OWN project, with the session
+// they already hold. This route stamps who sent it and which core this project
+// runs, then relays it to the hub's POST /sso/feedback over the hub-federation
+// client credential (ADR 0141) — the channel the activity rollup already uses. So
+// a builder never signs in to cloudbongos.com to report something about Bongos.
+//
+// Only the text the builder typed and version stamps travel. No code, transcript,
+// task or file content from this project is attached.
+//
+// In the CORE, not a module, for the reason core-update.js gives: the hub link is
+// kernel (src/bongos/auth-config.js), and every hosted project must have this door
+// whatever modules it runs. A project with no hub link (self-hosted, or the hub
+// itself) answers 409 not_hub_connected — told, not silently dropped.
+
+const express = require('express');
+const { asyncHandler, validateOrRespond } = require('./_helpers');
+const auth = require('../auth');
+const { loadIdpConfig } = require('../auth-config');
+const { userAgent } = require('../../branding');
+
+const MESSAGE_MAX = 4000;
+const HUB_TIMEOUT_MS = 15000;
+
+function safeIdpConfig() {
+  try { return loadIdpConfig(); } catch { return null; }
+}
+
+function runningCore() {
+  try { return require('../../module-api').CORE_VERSION || null; } catch { return null; }
+}
+
+// Hub refusals the builder can act on are passed through by code; anything else
+// is one generic failure, so the hub's internals never leak through this door.
+const PASS_THROUGH = new Set(['membership_required', 'rate_limited', 'feedback_unavailable', 'validation_failed']);
+
+async function relayToHub({ idp, builder, message, kind, context, fetchImpl = fetch }) {
+  const res = await fetchImpl(`${idp.origin.replace(/\/+$/, '')}/api/bongos/sso/feedback`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
+    body: JSON.stringify({
+      client_id: idp.clientId,
+      client_secret: idp.clientSecret,
+      github_id: builder.github_id,
+      message,
+      kind,
+      context,
+    }),
+    signal: AbortSignal.timeout(HUB_TIMEOUT_MS),
+  });
+  let body = null;
+  try { body = await res.json(); } catch { /* non-JSON answer */ }
+  return { status: res.status, body };
+}
+
+function buildFeedbackRouter({ idpConfig = safeIdpConfig, fetchImpl = fetch } = {}) {
+  const router = express.Router();
+
+  // rank: any signed-in builder — reporting a problem with Bongos grants nothing
+  // here, and the hub files every report at 'backlog' behind a Metic+ nod.
+  router.post(
+    '/feedback',
+    auth.requireBuilder,
+    asyncHandler('POST /feedback', async (req, res) => {
+      if (validateOrRespond(req, res, {
+        message: { required: true, type: 'string', maxLength: MESSAGE_MAX },
+        kind: { type: 'string', enum: ['bug', 'idea'] },
+        context: {},
+      })) return;
+      const b = req.body || {};
+      const message = b.message.trim();
+      if (!message) return res.fail('message_required', 400);
+      const kind = b.kind || 'bug';
+
+      const idp = idpConfig();
+      if (!idp) return res.fail('not_hub_connected', 409);
+
+      const ctx = b.context && typeof b.context === 'object' ? b.context : {};
+      const context = {
+        core_version: runningCore(),
+        cli_version: typeof ctx.cli_version === 'string' ? ctx.cli_version.slice(0, 40) : null,
+        os: typeof ctx.os === 'string' ? ctx.os.slice(0, 40) : null,
+      };
+
+      let hub;
+      try {
+        hub = await relayToHub({ idp, builder: req.builder, message, kind, context, fetchImpl });
+      } catch {
+        return res.fail('hub_unreachable', 502);
+      }
+      if (hub.status === 201 && hub.body && hub.body.ok) {
+        const { ok: _ok, ...landing } = hub.body;
+        return res.status(201).json({ ok: true, hub_origin: idp.origin, ...landing });
+      }
+      const err = hub.body && hub.body.error && typeof hub.body.error === 'object' ? hub.body.error : null;
+      if (err && PASS_THROUGH.has(err.code)) {
+        const retry = err.details && err.details.retry_after_seconds;
+        return res.fail(err.code, hub.status, retry ? { retry_after_seconds: retry } : undefined);
+      }
+      return res.fail('hub_refused', 502, { hub_status: hub.status });
+    }, { errorCode: 'feedback_failed', message: false }),
+  );
+
+  return router;
+}
+
+module.exports = buildFeedbackRouter;

package/src/bongos/routes.js

@@ -20,6 +20,7 @@ const express = require('express');
 const buildHealthzRouter = require('./routes/healthz');
 const buildInstanceRouter = require('./routes/instance');
 const buildCoreUpdateRouter = require('./routes/core-update');
+const buildFeedbackRouter = require('./routes/feedback');
 const buildAuthRouter = require('./routes/auth');
 const buildGithubRouter = require('./routes/github');
 const buildMeRouter = require('./routes/me');
@@ -144,6 +145,7 @@ function buildGdsRouter() {
   router.use(buildHealthzRouter());
   router.use(buildInstanceRouter());
   router.use(buildCoreUpdateRouter());
+  router.use(buildFeedbackRouter());
   router.use(buildAuthRouter());
   router.use(buildGithubRouter());
   router.use(buildMeRouter());

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.37'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.39'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');